Subject: Re: Randomness sources for the IETF 2015-2016 Nomcom Selection

From: Toerless Eckert <[email-masked]>
Date: Fri, 19 Jun 2015 10:11:02 -0700

Sorry, friday comic relief email:

I wonder how many spam filters hold back these NomCom process mails due to
their suspicious content ;-))

On Fri, Jun 19, 2015 at 10:03:03AM -0700, NomCom Chair 2015 wrote:
> As per RFC3777, and using the RFC3797, 
> Publicly Verifiable Nominations Committee (NomCom) Random Selection
> 
> the following are the seed selection that will be used on July 6, 2015 (2015-07-06).     
>                                                                                 
> Canadian Lottery Lotto 649                                                      
> Wednesday, July 1, 2015 Results:  
> https://loteries.espacejeux.com/en/lotteries/lotto-6-49?date=2015-07-01#res                                                                  
>   (7 numbers including the bonus number: numbers between 1 and 49)              
>                                                                                 
> US National debt ("Debt Held by the Public"), published by the                  
> Treasury department as of Thursday, July 2, 2014                                
> http://www.treasurydirect.gov/NP/BPDLogin?application=np  
>                       
> http://www.treasurydirect.gov/NP/debt/search?startMonth=07&startDay=2&startYear=2015&endMonth=&endDay=&endYear=                                                
>   Last 8 digits, ignore the commas and periods                                  
>                                                                                 
> US National debt ("Intragovernmental Holdings"), published by the               
> Treasury department as of Thursday, July 2, 2014, on the same link as above. 
>                                                
>   Last 8 digits, ignore the commas and periods                                  
>                                                                                 
> Euromillions Lottery                                                            
> Friday July 3, 2014 Results:                                                    
> http://www.europeanlotteryguild.com/lottery_results/euromillions_results/       
> http://www.europeanlotteryguild.com/lottery_results/euromillions_results/draw_history?results_date=2015-07-03                                                  
>   (7 numbers including the star balls: 5 numbers between 1 and 50 and 2         
>    star balls between 1 and 11)                                                 
>                                                                                                                                                             
> All the above seeds will be provided (in the order listed above) as             
> input to the RFC 3797 selection algorithm to determine the ten                 
> voting members of the 2014-15 Nomcom.                                           
>                                                                                 
> Harald Alvestrand                                                            
> Nomcom Chair 2015-16                                                         
> [email-masked]

-- 
---
Toerless Eckert, [email-masked]

---

From: Harald Alvestrand <[email-masked]>
Date: Fri, 19 Jun 2015 19:17:08 +0200

> their suspicious content ;-))

I do wonder, given that out of my database of 372 emails who have been 
said to have volunteered for the nomcom at one time or another, I have 
51 qualified and 120 non-qualified volunteers who have not replied to my 
emails.... the deadline is still Monday....

---

From: Toerless Eckert <[email-masked]>
Date: Fri, 19 Jun 2015 13:37:37 -0700

I don't think normal NomCom mails would be affected, just this
gratuitous lottery process announcement which might get filtered
because of way to many mentionings of lotteries.

So i thought this was more fun than serious if it got filtered.

Of course, if spam filters would associate nomcom with a lottery process
more permanently, then it might impact actually useful nomcom mails.

Cheers
    Toerless

---

From: Allison Mankin <[email-masked]>
Date: Fri, 19 Jun 2015 16:55:26 -0400

I agree this could be a concern, from my experience two years ago.

True nomcom aficionados, the ones who will run the selection process in
parallel with the Chair, will know that the official announcements from
this Nomcom are also found at:

https://datatracker.ietf.org/nomcom/ann/#2015

---

From: Joe Touch <[email-masked]>
Date: Mon, 22 Jun 2015 11:31:09 -0700

FWIW, I would appreciate if future selection of sources of randomness
for Nomcom selection omitted politically-charged values, especially
where entropy has not been established.

In particular, I see no reason to highlight the US Debt vs. that of
other countries or regions other than as a political statement.

There are plenty of lotteries from which to select random sources, and
the entropy of the debt values (even the low-order digits) has not been
validated.

Joe

---

From: "John Levine" <[email-masked]>
Date: 22 Jun 2015 21:45:50 -0000

>other countries or regions other than as a political statement.

The US debt has many digits, and is published regularly by an agency
with a tradition of not fudging the data.  It's a perfectly reasonable
source of randomness.  It's a large number because the US is a large
rich country.

I suppose the Japanese debt might be a usable substitute for next
time, since it's also a large rich country with a large debt.

R's,
John

---

From: Ted Faber <[email-masked]>
Date: Mon, 22 Jun 2015 14:52:39 -0700

> source of randomness.  It's a large number because the US is a large

Look, I think this issue is silly.  I'm just going to leave this link
here for peoples' enjoyment, though.

http://www.npr.org/sections/money/2012/07/30/156371620/rigging-libor-banking-scandal-hits-home-literally

I don't have any problem (practical, philosophical, or otherwise) with
the references to or use of the US national debt.

-- 
Ted Faber, Computer Scientist, USC/ISI
http://www.isi.edu/~faber
http://www.isi.edu/~faber/contact.html

---

From: Randy Bush <[email-masked]>
Date: Tue, 23 Jun 2015 06:55:24 +0900

> source of randomness.  It's a large number because the US is a large

< troll >

as we seem to be using it wholesale, one might wonder to how many
reliable digits of precision it is reported.

randy, somewhat interested in entropy and randomness

---

From: Joe Touch <[email-masked]>
Date: Mon, 22 Jun 2015 15:09:50 -0700

On 6/22/2015 2:45 PM, John Levine wrote:
> source of randomness.  

Why do you feel that's true?

There could easily be an artifact in how it's calculated that biases
certain values or increments, which could affect the numbers posted.

> It's a large number because the US is a large rich country.

It's 18E12 USD, which is 14th on a per-capita basis.

> time, since it's also a large rich country with a large debt.

FWIW, Japan is #6 in the total debt on a per-country basis:
https://en.wikipedia.org/wiki/List_of_countries_by_external_debt

I see no good reason to use debt values other than as a political statement.

The IETF and ISOC make far too many of these, IMO. This is a case where
there's good reason to do otherwise.

Lotteries are sufficient and prevalent.

Joe

---

From: Matthew Kerwin <[email-masked]>
Date: Tue, 23 Jun 2015 08:24:45 +1000

> the references to or use of the US national debt.

<silly>

Geohashing uses the opening value of the Dow Jones Industrial Average[1]
for entropy. However the current spec uses Google as a source, so that's
clearly untenable  ;)

Note that it also provides an achivement for anyone rich enough to
manipulate the Dow Jones in their favour[2]

[1] http://wiki.xkcd.com/geohashing/Algorithm
[2] http://wiki.xkcd.com/geohashing/Bill_Gates_achievement

</silly>

---

From: Nico Williams <[email-masked]>
Date: Mon, 22 Jun 2015 17:49:46 -0500

> > time, since it's also a large rich country with a large debt.

More digits!

> Lotteries are sufficient and prevalent.

Which lotteries?  One per-country would be insufficiently
representative.  How shall we choose lotteries and how many per-country?
Should we adjust by relative currency exchange rates?  ...

In case it's not clear: I am being facetious, and I think your concern
should be dismissed.  Including U.S. debt numbers is not a political
statement.  Each source's integrity is far more important that what a
particular number represents.  Entropy has no nationality.  Propose
adding more entropy sources if you like, but don't let this get out of
hand.

Nico
--

---

From: "John R Levine" <[email-masked]>
Date: 22 Jun 2015 19:50:14 -0300

> certain values or increments, which could affect the numbers posted.

Because I have some familiarity with the way the US debt works.  The low 
digit probably isn't random since most debt is sold in $1000 increments 
and there may be some artifact of the way the interest is rounded, but 
other than that it's the aggregate of a vast number of separate 
transactions.

> I see no good reason to use debt values other than as a political statement.

So you said.  Opinions evidently differ.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.

---

From: Joe Touch <[email-masked]>
Date: Mon, 22 Jun 2015 15:58:12 -0700

On 6/22/2015 3:49 PM, Nico Williams wrote:
> statement.

I claim there is no good reason to repeatedly used the debt value of a
single country as such a value other than as such a statement.

If you believe there is, then make your case.

If not, then we should either rotate countries or omit debt values from
this process.

Joe

---

From: Joe Touch <[email-masked]>
Date: Mon, 22 Jun 2015 16:02:13 -0700

On 6/22/2015 3:50 PM, John R Levine wrote:
> Because I have some familiarity with the way the US debt works.

Entropy proofs aren't typically based on the principle of "some
familiarity".

> The low
> other than that

Yes. Other than that.

Joe

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Jun 2015 19:38:06 -0400

--On Monday, June 22, 2015 14:52 -0700 Ted Faber <[email-masked]>
wrote:

> Look, I think this issue is silly.  I'm just going to leave
> this link here for peoples' enjoyment, though.

+1

FWIW, there was a time in my life when I had the dubious
privilege of having to pay a lot of attention to methods of
generating random numbers and how random the results were.  It
didn't turn out to be a lot of fun, but the nearly-intuitive
parts are:

* Using values from a selection of independent random and
pseudo-random sources is a lot safer than relying on one source.
That is, of course, what the IETF process tries to do.  If
sufficient analysis is done to know how a particular number
varies, dropping a number of leading and trailing digits based
on that knowledge can improve randomness.  For example, the
leading digits of a lot of public statistics (including, e.g.,
debt or stock market values) don't fluctuate very much on a day
over day basis so one is better off not including them in the
calculation.  However, doing the analysis is a lot of trouble
and the effects after the hashing described in RFC 3797 may be
trivial -- we should try to remember that there is really no
such thing perfect numeric randomness and that the goal is,
necessarily, "good enough"

* You don't want to use lotteries unless (i) You have sound,
long-term, statistical reasons to know that they are really
random.  Historically, with no deliberate efforts at
manipulation, some of them have rather poor track records.  (ii)
If you use multiple lotteries, you need to be sure that their
results are uncorrelated.  In practice, that is likely to mean
that you need to be sure that they don't use the same random
number generation process for a seed-based process, knowing that
they are using different seeds may not be enough.  (Although
with the same qualification about "good enough" as above.)

* Again, the strength of the IETF value selection process is
that it draws from several sources of numbers that we have a
reasonable expectation of being independent.   That can be much
more important than how random a particular source actually is.
Put differently, if there were evidence that the national debt
figure for Absurdistan was being manipulated, it would make
little or no difference as long as it was large/long enough and
we chose digits that varied a lot (e.g., were not the result of
predictable rounding behavior and for which there was no
systematic correlation among digits in a group).  

All of that said, making a rule that those making up the
selection rules were not permitted to use debt (or any other
national statistic) from the same country two years in a row (or
even two years out of three or five) would strike me as a
political statement.  Given the way the whole procedure works,
repeated use of one country's statistic(s) to get some digits
seems no more political than a choice of lotteries or horse
races.

We now return you to the next regularly-scheduled demonstration
of the ability of the IETF list to generate very long treats
about topics that make very little difference.

  best,
   john
   (wearing my long-disused hat as a card-carrying statistician)

---

From: Joe Touch <[email-masked]>
Date: Mon, 22 Jun 2015 17:23:10 -0700

On 6/22/2015 4:38 PM, John C Klensin wrote:
> Given the way the whole procedure works,

If that is true, then why not make it so? Or use other numbers that are
similarly random and independently verifiable? (e.g.,, the low-order
numbers of the individual stocks on the Dow Jones or FTSE).

I made a simple request that is trivial to address for a convention that
is NOT required by the cited RFCs.

The push back I've seen so far indicates to me that there are clear
political motivations for using the US Debt numbers instead. So be it.

I'll be glad to pick equally offensive values for entropy in the next
specs I author.

Joe

---

From: Randall Gellens <[email-masked]>
Date: Mon, 22 Jun 2015 18:12:20 -0700

>  I'll be glad to pick equally offensive values for entropy in the next

I just happened to see this thread, and this response makes me very 
curious.  Quite likely I'm naive or ignorant, so this may be very 
obvious, but I can't see what political statement is being made, or 
how the sources are offensive.  Obviously, the debt and budget of any 
nation is a political topic, but I can't see what statement is being 
made by using it as a source of digits, or who is being offended and 
why.

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
Survivor of Siamese Twins Joins Parents
--Newspaper headline

---

From: Joe Touch <[email-masked]>
Date: Mon, 22 Jun 2015 18:35:45 -0700

On 6/22/2015 6:12 PM, Randall Gellens wrote:
> obvious, but I can't see what political statement is being made, or how
> the sources are offensive.  Obviously, the debt and budget of any nation
> is a political topic, but I can't see what statement is being made by
> using it as a source of digits, or who is being offended and why.

If you don't feel it's an issue, then let's use the debt of another
group - e.g., the EU, and we're done.

If you think that's not appropriate to use the EU instead of the US,
then that's why we shouldn't use the US.

Joe

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Jun 2015 22:03:41 -0400

--On Monday, June 22, 2015 18:35 -0700 Joe Touch <[email-masked]>
wrote:

> If you don't feel it's an issue, then let's use the debt of
> another group - e.g., the EU, and we're done.
> 
> If you think that's not appropriate to use the EU instead of
> the US, then that's why we shouldn't use the US.

Joe,

If the EU debt met all of the criteria identified in 3797, I
would see no reason to avoid using it.  I don't know whether
there is such a thing as "the EU debt" that is readily available
and verifiable that that the right number was chosen, whether
than number fluctuates enough from day to day to be suitable, or
whether there are similarly-available values for the aggregate
debt of EU member states.   But I see absolutely no objection in
principle to using the EU debt or any similar national or
regional number.  

Such an objection would be as political as insisting that the US
number not be used (or not).  I just don't think anyone by you
thinks such an argument has been made.

    john

---

From: "John Levine" <[email-masked]>
Date: 23 Jun 2015 03:35:44 -0000

>there is such a thing as "the EU debt"

There is no such thing as "the EU debt."  Each EU member country has
its own national debt.  Some of that debt is denominated in Euros,
some in national currencies such as UK pounds, Danish Krone, Romanian
Lei, and so forth.  The Danish Krone and Bulgarian Lev are tightly
tied to the Euro, while the pound and other non-euro currencies float
and the rates change continuously while markets are open.  Not only is
there no such thing as the EU debt, there is no consistent way to find
the Euro value of the combined national debts, both because it depends
on what exchange rates you use, and because the debts of some Eurozone
countries (notably Greece) are held in part by the governments of
other Eurozone countries (notably France and Germany) so they net out.

The US debt happens to be unusually easy to use as a data source since
it is a single country's debt in its own currency that no other
country of any size* uses, and the US publishes very good economic
data.  Given its advantages, and the points you made about the
importance of larger amounts of data rather than perfect randomness of
individual sources, I'd want something more persuasive than loud
unsupported assertions to switch to something else.

R's,
John

* - yeah, I know about Panama, Ecuador, the Bahamas, and the BVI

---

From: joel jaeggli <[email-masked]>
Date: Mon, 22 Jun 2015 21:28:41 -0700

>> using it as a source of digits, or who is being offended and why.

The appointed chair can choose the source seeds and indeed the algorithm
according to their whim so long as they meet the critera described in
7437 which informatively  cites 3797. It is their prerogative, not ours
to do so.

---

From: Harald Alvestrand <[email-masked]>
Date: Tue, 23 Jun 2015 14:43:11 +0200

> political motivations for using the US Debt numbers instead. So be it.

Speaking as the person who actually picked these lotteries and numbers:

I picked them because it was the minimum change possible to what was 
done last year (the only effort required was to update an URL that had 
changed over the course of the year).

The next nomcom chair will have additional input since this debate has 
occured.

Speaking as another geek:

I see the value of having multiple types of sources as being that no 
single organization is likely to be able to manipulate *all* of these 
without being detected - at least for an input that is commensurate with 
the value of controlling the pick of nominees for next year's Nomcom.

The important properties of input are:

- They should be hard for anyone to fix before the fact
- They should be easy for anyone to check after the fact

I thought of adding a Norwegian lottery to the mix (THAT would have been 
strictly as a political statement), but decided not to bother; finding 
the correct URL and verifying that it had remained
stable for a reasonably long time was more work than I found worth doing.

> I'll be glad to pick equally offensive values for entropy in the next
Feel free, but don't expect me to care.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 23 Jun 2015 09:18:01 -0400

>From a security point of view, the question is not whether the inputs are
random, it is whether they are vulnerable to manipulation. Having more
inputs does not make a system more robust against this type of attack, it
makes it more vulnerable.

If we are changing our ECC curves due to the possibility that NIST might
have been suborned, we should not be using a number so obviously capable of
being manipulated as an input.

The reason that we can trust lottery numbers is not that they are
absolutely immune from tampering. We can trust them because anyone who
could be bothered to tamper with them has a much bigger incentive than
manipulating the IETF NOMCON choices. This means that we can put a dollar
value on the manipulation, a few hundred million USD.

The issue isn't just whether an attack is likely, it is a matter of
reputation. We are not changing our curves because we believe NIST
manipulated them. We are changing our curves because some Major desperate
to make Colonel and keep their job wrote a bunch of silly slides that
leaked. And given that the agency concerned has an up-or-out promotion
policy and the person in charge only values attack as a strategy, the
slides were all designed to present the work done as attacking and
manipulating.

[As an aside, expecting people who work in fear of their jobs to take
courageous acts against their commanding officer when ordered to commit
illegal or immoral acts is naive at best.]

I suggest we remove the US debt from the equation entirely as it is not an
appropriate source of randomness. The internal means of construction is not
opaque, nor is it automatic. Ergodicity is not the test that matters,
transparency is.

---

From: John C Klensin <[email-masked]>
Date: Tue, 23 Jun 2015 09:40:16 -0400

--On Tuesday, June 23, 2015 03:35 +0000 John Levine
<[email-masked]> wrote:

> There is no such thing as "the EU debt."  Each EU member
> country has its own national debt.  Some of that debt is
> denominated in Euros, some in national currencies such as UK
> pounds, Danish Krone, Romanian Lei, and so forth.  The Danish
> Krone and Bulgarian Lev are tightly tied to the Euro, while
>...

Thanks.  That was approximately what I had assumed from assorted
news reports and a vague understanding of the system, but I
didn't know offhand and didn't have the time to check it out.

> The US debt happens to be unusually easy to use as a data
> source since it is a single country's debt in its own currency
> that no other country of any size* uses, and the US publishes
> very good economic data.  Given its advantages, and the points
> you made about the importance of larger amounts of data rather
> than perfect randomness of individual sources, I'd want
> something more persuasive than loud unsupported assertions to
> switch to something else.

As Joel pointed out, the specs leave the choices up to the
Nomcom Chair each year as long as specified criteria are met.
There is really no basis, other than expressions of personal
opinion (and political preferences) for criticizing the choices
unless those criteria have not been adhered to.  We have not
heard a single claim that the criteria were violated.  Harald
explained the reason for his choices (which he was certainly not
obligated to do), so I suggest we move on.

One suggestion for those who don't like the choices (for
whatever reason): If someone feels passionately enough about
this to want to do some work rather than complaining, I think
doing the research and posting a list of a hundred or two
plausible choices would be useful.  The list should not be
normative or otherwise restrict Nomcom chair choices, but I
infer from Harald's comment that one of the reasons for making
particular choices is precisely that it was easy and the
alternatives would require significant research work, so making
a long list of possible options, with URLs and whatever
historical, statistical, or other explanations are needed might,
over time, improve the diversity of the selections made just by
making more options readily available.  I do believe, however,
that any such document should either make clear that
diversifying the choices is an aesthetic or political statement
rather than a way to significantly improve either randomness or
lack of predictability of the final results unless the latter
can be demonstrated on a sound statistical basis.

    john

---

From: Ofer Inbar <[email-masked]>
Date: Tue, 23 Jun 2015 10:00:26 -0400

To me, the idea that it's "political" to use the US debt, is on its
face hard to believe or take seriously.  So before everyone else has
to justify every other claim down to many levels of detail, can we see
any justification of the claim that there's any disadvantage to using
this convenient number, or that it's done for political reason?

Occam's razor suggests it's just being used because it's convenient
and easy to use and meets the criteria, and once it got into the mix
there was no reason not to keep it the next year, or the next.  It's
easier to keep things that still work, than it is to spend extra time
searching for replacements for no particular reason or advantage.
  -- Cos

---

From: John C Klensin <[email-masked]>
Date: Tue, 23 Jun 2015 11:41:24 -0400

--On Tuesday, June 23, 2015 09:18 -0400 Phillip Hallam-Baker
<[email-masked]> wrote:

> random, it is whether they are vulnerable to manipulation.
> Having more inputs does not make a system more robust against
> this type of attack, it makes it more vulnerable.

I am not a cryptographer and don't even play one on television.
But my statistical intuition (and the reasoning in RFC 3797)
causes me to question the latter assertion.  I note, for example
that almost everyone who has taken an introductory, sampling or
data-based, stats course has been told that the remedy for the
likelihood than a subject will end up in the sample who is not
representative of the population is larger sample sizes.
Assuming that there is no direct relationship between a
particular source and the output, the same principle suggests
that (up to a point, see 3797) requiring more sources should
reduce the effects of one manipulated source.   In the interest
of sanity, I'm not interested in discussing it further on this
list -- if you believe the 3797 is wrong, I look forward to a
carefully-researched and well-documented I-D that both
demonstrates that and proposes something better.

> If we are changing our ECC curves due to the possibility that
> NIST might have been suborned, we should not be using a number
> so obviously capable of being manipulated as an input.
> 
> The reason that we can trust lottery numbers is not that they
> are absolutely immune from tampering. We can trust them
> because anyone who could be bothered to tamper with them has a
> much bigger incentive than manipulating the IETF NOMCON
> choices. This means that we can put a dollar value on the
> manipulation, a few hundred million USD.

Just following that logic, could you explain who would have the
power and incentive to manipulate the reported US national debt
in order to affect the IETF Nomcom selection process?  I suppose
that demonstration would start by demonstrating that there are
people involved in the debt analysis and reporting process who
have even heard about the IETF and its nomination process and
who give a rat's a** about it?  Given the 3797 criteria (or the
definition of unbiased in 7437), it seems like a real stretch
and, frankly, that it would be more productive to worry about
lotteries with bad randomization processes or algorithms.

I also observe that someone trying to attack the IETF process
would, in most cases, need to figure out how to attack a
particular day's numbers and not the overall formula or method
of producing the relevant value or statistic.  That seems even
more far-fetched, especially because the day on which the
numbers will be drawn is not generally known.

If one were worried about being extra-cautious about
predictability of a future draw, I'd wonder a bit about
autocorrelation in any economic statistic but, again, if one
were concerned about that, one might get more sophisticated
about trimming high-sensitivity (to autocrrelation) digits from
the numbers.  However, again with the assumption that drawing
numbers from multiple sources adds to to diversity and
randomness (at least absent evidence of specific, IETF-focused
manipulation of multiple sources), it seems to me a real stretch
to believe that is occurring or likely to occur.

I am not going to contribute to this thread and where I think it
belongs by making this my last posting on the subject.

    john

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 23 Jun 2015 12:23:06 -0400

On Tue, Jun 23, 2015 at 11:41 AM, John C Klensin <[email-masked]> wrote:

> causes me to question the latter assertion.

The attack isn't statistical. If I control an input and the other inputs
are known, I can manipulate the output. So the more parties that control an
input, the greater the chance of default.

The last input obviously has the most influence. But the second to last
also has some effect if the final one doesn't add much randomness. If the
objective is to keep one particular person in or out of the NOMCON and a
non-trivial amount of CPU time is spent, manipulation becomes plausible by
the second in line.

Of course being able to delay the input to last is the strongest form of
attack.

> in order to affect the IETF Nomcom selection process?

But we are not using the US national debt. We are using the reported value
of the US national debt. While your country is of course entirely
incorruptible when it comes to such matters and there isn't anyone who
would ever imagine making such a manipulation at the mere suggestion that
'national security' is at stake, this is certainly not the case in mine. If
you read Peter Wright's Spycatcher you will find numerous instances of
similar acts by officialdom for even more trivial objectives.

> I suppose
> who give a rat's a** about it?

Oh come on, that is not the mechanism I suggested any you know it. The
decision that manipulating the process was desirable would come from
somewhere else. Then they would either identify the person in the stats
office responsible for compiling the figures or they would hack into their
computer to allow the results to be fiddled.

> numbers will be drawn is not generally known.

Which is part of the problem as noted above.

Whether or not people think this is a problem in practice is a lot less
important than the question of whether someone can plausibly claim it is a
problem.

Having set up and operated CAs, I am used to people proposing all manner of
unlikely attacks and I have spent a great deal of time and effort on
controls designed to provide auditable assurance that attacks far less
likely than this one are prevented.

That said, the other reason to take out the US national debt is that using
it suggests that the IETF is taking a political position on its importance.
Why not take the US unemployment numbers instead? Or the number of people
who applied for Obamacare? I think it is quite obvious that the last two
would be a very bad idea.

---

From: Joe Touch <[email-masked]>
Date: Tue, 23 Jun 2015 10:33:04 -0700

> this convenient number, or that it's done for political reason?

1) zero evidence that this is an accurate source of entropy.

There are modern alternatives:

- treat Nomcom selection as something other than the securing of
international resources, and use a seed based on the message ID of the
first Nomcom announcement or such.

- use a *true* source of entropy, such as quantum effects or energy
noise. Two alternatives, based on these two effects respectively,
already exist:

	http://www.nist.gov/itl/csd/ct/nist_beacon.cfm
		includes signed escrowed values from previous dates

	https://www.random.org/
		this one has a list mode that can be based on previously
		generated values:
		https://www.random.org/lists/?mode=advanced

The use of a true source of entropy would also obviate reliance on hash
algorithms as well.

Joe

---

From: Joe Touch <[email-masked]>
Date: Tue, 23 Jun 2015 10:40:29 -0700

On 6/23/2015 6:40 AM, John C Klensin wrote:
> plausible choices would be useful. 

It's more useful to refer to sources of known entropy derived directly
from physical processes. All other sources are approximations at best.

Joe

---

From: Joe Touch <[email-masked]>
Date: Tue, 23 Jun 2015 10:43:26 -0700

On 6/23/2015 8:41 AM, John C Klensin wrote:
> if you believe the 3797 is wrong, I look forward to a

Anyone who knows what entropy means knows where the only true sources
arise: physical processes. These include:

	- quantum effects
	- thermal noise
	- radioactive decay

I cited two online services that provide true sources of entropy based
on the first two of these - the first of which is digitally signed and
escrowed, and both of which provide access to past values for verification.

If we need more than that, perhaps I should submit a physics book as an RFC.

Joe

---

From: Eric C Rosen <[email-masked]>
Date: Tue, 23 Jun 2015 14:12:20 -0400

> Speaking as the person who actually picked these lotteries and numbers:

Wouldn't it be simpler and just as effective to pick the names of the 
nomcom members out of a hat?  Just make sure to give it a good shake first.

Or do people really think that the main problem in selecting good IESG 
members is that the process that selects the nomcom members is 
insufficiently random?

---

From: Clint Chaplin <[email-masked]>
Date: Tue, 23 Jun 2015 11:19:39 -0700

I believe that publicly verifiable by anybody who cares is also a design
criteria.  At least in the process for NonCom selection as we currently run
it everybody knows the process and algorithm, everybody is notified in
advance what inputs will be used and where they are obtained, and anybody
can run the process and algorithm themselves to verify the same results.

Using other physical sources of randomness allows the person running the
process to keep running the process with different inputs until an outcome
desirable by him is obtained.

-- 
Clint (JOATMON) Chaplin
Principal Standards Engineer
Samsung R&D Institute America

---

From: Yoav Nir <[email-masked]>
Date: Tue, 23 Jun 2015 21:19:44 +0300

> On Jun 23, 2015, at 9:12 PM, Eric C Rosen <[email-masked]> wrote:
> 
> Wouldn't it be simpler and just as effective to pick the names of the nomcom members out of a hat?  Just make sure to give it a good shake first.
> 
> Or do people really think that the main problem in selecting good IESG members is that the process that selects the nomcom members is insufficiently random?

Picking out of a hat is random enough. It’s just not very verifiable. I’m not saying that Harald would manipulate the draw, but some people might and we won’t be able to prove to them that the process was not manipulated.

Yoav

---

From: Michael Richardson <[email-masked]>
Date: Tue, 23 Jun 2015 14:39:14 -0400

> first Nomcom announcement or such.

Huh? That's entirely predictable by the nomcom chair.

    > noise. Two alternatives, based on these two effects respectively,

That's not verifiable.

Did you even read BCP10 and rfc3797?

    > includes signed escrowed values from previous dates

That would actually work, thank you for bringing it up.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 23 Jun 2015 14:40:28 -0400

On Tue, Jun 23, 2015 at 2:19 PM, Yoav Nir <[email-masked]> wrote:

> Picking out of a hat is random enough. It’s just not very verifiable. I’m
> not saying that Harald would manipulate the draw, but some people might and
> we won’t be able to prove to them that the process was not manipulated.
>

That is the whole point, it is not the randomness that is the issue it is
the ability to verify that the process is fair.

There are excellent processes for doing just that but they depend on being
able to make the draw under verifiable circumstances. To apply them to IETF
process we would have to delay the whole process to be able to make the
draw at an IETF.

Quantum approaches fail for the same reason. Your black box might be random
but I have no way to determine if it is fair.

Now there are cryptographic protocols we could use that would be verifiably
fair and allow everyone to audit the process independently.

For example (and giving a handwavy, not secure description for brevity),
everyone who wants to contribute to the generator creates a random or
non-random value of their choice and encrypts it under a random key of
their choice. They then submit the encrypted blob before a deadline is
passed. At the deadline the list of submitted blobs is revealed and the
submitters reveal their decryption keys.

To make the process secure it is necessary to ensure that there are
appropriate commitments, yada yada. But thats not too difficult to achieve.

---

From: Christian Huitema <[email-masked]>
Date: Tue, 23 Jun 2015 18:40:23 +0000

> Picking out of a hat is random enough. It's just not very verifiable. I'm not saying
> that Harald would manipulate the draw, but some people might and we won't
> be able to prove to them that the process was not manipulated.

This thread is really fun. Don't we all love engineering and over-engineering? 

As Yoav said, the process was designed to provide a verifiable equivalent to picking names from a hat. The main thread here is manipulation by the person doing the picking, so we designed a verifiable process. And since we are engineers, we had some fun picking verifiable outside sources of randomness. But really, this is about emulating picking from a hat in a way that let any observer verify the picking.

In theory, since we are picking 10 names out of a pool maybe 100 to 200 volunteers at most, we would need 44 to 55 bits of entropy. The lotteries in Harald's list provide about 74 such bits. The debt numbers' entropy are less easy to compute, and depending on your assumptions add 10 to 50 other bits. As many have pointed out, it is extremely unlikely that any of those numbers might be manipulated for the sole purpose of influencing the nom com selection. So basically, we are good. 

But it is fun.

-- Christian Huitema

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 23 Jun 2015 16:51:36 -0400

On Tue, Jun 23, 2015 at 2:40 PM, Christian Huitema <[email-masked]>
wrote:

> As Yoav said, the process was designed to provide a verifiable equivalent
> to picking names from a hat. The main thread here is manipulation by the
> person doing the picking, so we designed a verifiable process. And since we
> are engineers, we had some fun picking verifiable outside sources of
> randomness. But really, this is about emulating picking from a hat in a way
> that let any observer verify the picking.
>
> In theory, since we are picking 10 names out of a pool maybe 100 to 200
> volunteers at most, we would need 44 to 55 bits of entropy. The lotteries
> in Harald's list provide about 74 such bits. The debt numbers' entropy are
> less easy to compute, and depending on your assumptions add 10 to 50 other
> bits. As many have pointed out, it is extremely unlikely that any of those
> numbers might be manipulated for the sole purpose of influencing the nom
> com selection. So basically, we are good.
>
> But it is fun.
>

Remember that we are a standards body and that part of the point here is to
develop building blocks that other people can build on.

Let us for the sake of argument assume that the NIST source is perfectly
random.

Let us further assume that collusion between NIST and some subset of n IETF
persons can be considered 'infeasible'.

I think that we can pretty easily develop a protocol involving commitments
that provides a provably fair process even if just one of the participants
does not default.

Of course this is over-engineered for picking the NOMCON. But it isn't
over-engineered for purposes such as picking crypto constants.

---

From: Randall Gellens <[email-masked]>
Date: Tue, 23 Jun 2015 14:45:20 -0700

>  in order to affect the IETF Nomcom selection process?

If someone wanted to manipulate the outcome of the Nomcom selection 
process, wouldn't there be far easier methods?  E.g., stacking the 
list of volunteers with individuals over whom the manipulator has 
influence?

-------------- Randomly selected tag: ---------------
This fortune intentionally not included.

---

From: Dave Cridland <[email-masked]>
Date: Tue, 23 Jun 2015 23:00:29 +0100

On 23 June 2015 at 22:45, Randall Gellens <[email-masked]> wrote:

> process, wouldn't there be far easier methods?  E.g., stacking the list of
> volunteers with individuals over whom the manipulator has influence?

It's marginally easier to manipulate the nominees, I think, but it depends
on your end-goal.

Dave.

---

From: Randall Gellens <[email-masked]>
Date: Tue, 23 Jun 2015 14:57:39 -0700

>  This thread is really fun. Don't we all love engineering and 

Indeed.

What about daily weather for pre-determined locations on 
pre-determined dates as reported by pre-determined sources?

E.g.,
- 
http://fivethirtyeight.com/features/which-city-has-the-most-unpredictable-weather/
- http://www.forecastwatch.com/news/Reports/BestPlaces2005/

-------------- Randomly selected tag: ---------------
        Pedestrians are

       (a) irrelevant.
       (b) communists.
       (c) a nuisance.
       (d) difficult to clean off the front grille.

The correct answer is (a).  Pedestrians are not in cars, so they are
totally irrelevant to driving; you should ignore them completely.

---

From: joel jaeggli <[email-masked]>
Date: Tue, 23 Jun 2015 15:10:13 -0700

On 6/23/15 2:45 PM, Randall Gellens wrote:
> process, wouldn't there be far easier methods?  E.g., stacking the list
> of volunteers with individuals over whom the manipulator has influence?

Given that you can highly bias the outcome by ensuring that the
candidate pool is sufficiently small (frequently this involves doing
nothing at all) that seems like a lot of work.

---

From: Michael StJohns <[email-masked]>
Date: Wed, 24 Jun 2015 13:06:23 -0400

>nothing at all) that seems like a lot of work.

The size of the candidate pool has nothing at all to do with it.  It's the strict proportion of the number of nominees that you control that's the figure of merit.  If you have approximately 30% of the candidate pool, regardless of the size of the pool, 85% of the time you will have 2 members selected.  (This is a binomial distribution where the value for 2 is the sum of all the percentages for getting 2,3,...10 members) 

Percent of Volunteer Pool vs Chance of having two members
1.0%    0.4% 
5.0%    8.6% 
10.0%   26.4% 
15.0%   45.6% 
20.0%   62.4% 
25.0%   75.6% 
30.0%   85.1% 
35.0%   91.4% 

Percent of Volunteer Pool vs chance of having 0 members.
1.0%    90.4% 
5.0%    59.9% 
10.0%   34.9% 
15.0%   19.7% 
20.0%   10.7% 
25.0%   5.6% 
30.0%   2.8% 
35.0%   1.3% 

The figures for getting exactly 1 member are left as an exercise.

The numbers above are a consequence of limiting the number of members from a single organization rather than limiting the volunteer pool percentages.

Later, Mike